What is the recommended approach to implementing Tanium RBAC for a new customer?

• A. Grant full access to all users by default.
• B. Enable RBAC at project scope early, define roles, assign users via groups, enforce least privilege, and audit activity.
• C. Disable RBAC entirely.
• D. Only use built-in roles and do not customize.

Answer: (B)

Setting up Tanium RBAC effectively means starting with a scoped, role-based model that enforces least privilege and provides governance through auditing. Implementing RBAC at the project level early ensures permissions align with how the customer will operate. Define roles that mirror team responsibilities, assign users through groups for scalable management, and grant only the privileges each role needs. Regular auditing of who did what helps detect misuse and prove compliance.

That approach is best because it builds security and governance into the deployment from the start. Granting full access by default undermines security by giving everyone more power than they need. Disabling RBAC eliminates essential access control entirely. Relying only on built-in roles and not customizing prevents tailoring permissions to the organization’s specific workflows and the principle of least privilege.